Tuesday, September 01, 2026

Expired TLS certificates block new client connections and break internal authentication for replica set or sharded cluster members using X.509. This guide details a same-CA renewal process, issuing replacement leaf certificates for servers, members, and clients. The approach is designed to maintain service continuity during the rotation.

• Expired certs halt client access and internal member authentication in X.509 clusters.
• Same-CA renewal simplifies the process by reusing the existing certificate authority.
• Replace server, member, and client leaf certificates to restore full connectivity.
• Follow the specific rotation steps to minimize service interruption during updates.

PostgreSQL 19 is projected to introduce the most significant modifications to the pg_catalog schema in the system's history. This critical metadata layer exposes database structure and real-time server state, making it essential for diagnosing replication lag, lock contention, and query performance issues. As these catalogs evolve, engineers must stay aware of shifting column definitions and view structures to maintain effective operational visibility.

• PG19 will break more catalog conventions than any previous release, altering metadata schemas.
• pg_catalog is the primary interface for inspecting tables, indexes, and live server activity.
• Diagnosing locks, vacuum, and replication lag relies heavily on stable catalog views.
• Monitor upcoming release notes for specific column additions or removals in pg_stat_activity and pg_locks.
• Update internal monitoring scripts to handle potential schema drift in the next major version.

Fleet impact: As a DBA managing ExaCC/RAC or Aurora, treat pg_catalog as a moving target; PG19 changes may break legacy diagnostic queries or custom metadata extraction scripts. Audit your monitoring tools and automated health checks against the PG19 release notes to ensure compatibility with new or removed catalog columns.

Amazon Aurora MySQL-Compatible Edition 3 is now generally available with version 3.13, aligning with MySQL 8.0.45. This release integrates community MySQL fixes alongside specific Aurora enhancements to improve stability and feature parity. Upgrades can be executed in-place or via snapshot restore during scheduled maintenance windows, with support across all AWS Regions where the service is offered.

• Upgrade to Aurora 3.13 for MySQL 8.0.45 compatibility and latest community fixes.
• Use automatic minor version upgrades or orchestrate phased rollouts via AWS Organizations.
• Perform in-place upgrades or utilize snapshot restores for migration flexibility.
• Available in all AWS Regions supporting Aurora MySQL.
• Review release notes for specific performance improvements and bug fixes.

LongGuard analyzes why safety guardrails trained on short text degrade with long inputs. It introduces SafetyNIAH, showing unsafe recall drops over 50% as context length increases from 0.25k to 32k. Mechanistic analysis attributes this to proportional dilution of the unsafe signal in attention heads rather than absolute length constraints.

• Safety guardrails suffer >50% recall drop on long contexts due to signal dilution
• Failure is proportional, not absolute, linked to attention mechanism behavior
• LongGuard provides training-free mitigation and mechanistic analysis tools
• Current guardrails are brittle and require re-evaluation for long-context use cases

A rigorous audit compares ConfLayers and SWIFT, two methods that skip transformer layers during LLM inference to save compute. Testing on Qwen2.5 models for reasoning and summarization shows SWIFT achieves superior accuracy in three of four scenarios. ConfLayers performs poorly, especially on complex reasoning tasks.

• SWIFT's self-speculative decoding offers better accuracy than confidence-gated early exits.
• Periodic layer skipping can maintain performance while reducing inference cost.
• ConfLayers shows significant accuracy deficits on GSM8K reasoning tasks.
• Results hold across Qwen2.5-0.5B and 1.5B model scales.

A new arXiv paper introduces CLAIMPROBE, a claim-level audit tool that decomposes deep-research reports to detect hallucinations, misattribution, and citation hygiene issues. The study reveals that standard rubric-based evaluations often mask these fine-grained factual failures, allowing pipelines to maintain stable scores while omitting key evidence. To address this, the authors propose CLAIMWRITER, a hierarchical writer that maps source facts to a query-derived outline for more faithful report generation.

• Rubric scores can hide factual errors; use claim-level audits like CLAIMPROBE for precision.
• CLAIMWRITER replaces the writer component to improve faithfulness across existing DR frameworks.
• Decomposing reports into claims exposes misattribution and missing evidence rubrics miss.

Simon Willison has released a detailed reference guide for ChatGPT's built-in tools and capabilities. The resource aggregates documentation on how the model interacts with various functions, offering a structured way to understand its operational limits and features. It serves as a quick lookup for developers integrating or testing these specific agent behaviors.

• Centralized reference for ChatGPT's native tooling capabilities
• Useful for debugging agent interactions and tool usage
• Clarifies functional boundaries within the ChatGPT environment
• Helps engineers design more reliable tool-calling workflows

Researchers demonstrate that a single 9 GB open-weight model, specifically Qwen2.5-14B quantized to 4-bit, can process the entire open Jeopardy! dataset comprising 529,939 clues from 1984 to 2025. This approach contrasts sharply with IBM Watson's 2011 era, where knowledge was locked in a curated billion-document corpus on specialized POWER7 hardware. The work highlights the shift from static, hardware-bound knowledge bases to portable, free, and queryable local LLM artifacts.

• A 9 GB 4-bit Qwen2.5-14B model handles 530k historical Jeopardy clues locally.
• Demonstrates portability advantage over IBM Watson's frozen, hardware-specific corpus.
• First known evaluation of a model against the complete 41-year Jeopardy dataset.
• Validates open-weight models for dense, long-tail factual retrieval tasks.

AWS has added NVIDIA's Cosmos3-Edge, Nano, and Super foundation models to SageMaker JumpStart, targeting physical AI applications like robotics and autonomous vehicles. These open, omni-modal world models allow systems to perceive, reason, and act in the physical world. The Cosmos3-Edge variant is specifically optimized for on-device control, featuring a 4B-parameter model with a 2B reasoner that operates at 15 Hz for real-time inference.

• Three new NVIDIA Cosmos3 models are now one-click accessible via SageMaker JumpStart.
• Cosmos3-Edge delivers real-time 15 Hz inference for on-device robot control and vision.
• The model family supports robots, autonomous vehicles, and physical AI reasoning tasks.
• Cosmos3-Edge combines a 4B omni-model with a 2B Nemotron-based reasoner for efficiency.

DoorDash has migrated its engineering agent workloads from local developer machines to its internal Flux cloud platform. This move enabled the automation of 130,000 engineering tasks in a single month, including over 25,000 weekly automated code reviews. The system leverages isolated Firecracker microVMs, an MCP gateway, and reusable playbooks to execute these workflows with scoped access and centralized auditing.

• Migrating agent workloads from laptops to cloud infrastructure significantly scales automation capacity.
• Flux platform processed 130,000 engineering tasks monthly, demonstrating high-volume operational efficiency.
• Security is enforced via Firecracker microVMs, providing isolated execution environments for agents.
• Centralized auditing and scoped access control are built into the agent workflow invocation layer.
• The architecture supports multiple invocation surfaces and reusable playbooks for flexible task execution.

AWS has released the Agent Registry as generally available, offering a private, governed catalog for agents, tools, skills, and MCP servers. It enables teams to discover existing AI capabilities rather than rebuilding them, with access via the console, CLI, SDK, and as an MCP server for IDE integration. The service supports semantic and keyword search to help builders find resources within Amazon Bedrock AgentCore, Quick, and Kiro IDE.

• Centralizes discovery of agents, tools, and MCP servers in a private, governed catalog.
• Reduces redundancy by allowing teams to reuse existing AI capabilities.
• Integrates directly into IDEs via MCP server for seamless builder workflows.
• Available through console, CLI, SDK, and within Bedrock AgentCore and Kiro IDE.

Amazon Quick now allows users to search, browse, and enable agents and MCP servers from the AWS Agent Registry directly within the interface. Connection details are automatically populated from the registry, removing the need for manual configuration. This integration enables technical teams building with Amazon Bedrock AgentCore to share resources with business users across chat, apps, and deep research workflows.

• Search and enable AWS Agent Registry resources directly in Amazon Quick without manual setup.
• Connection details auto-populate, reducing configuration friction for end users.
• Bridges gap between Bedrock AgentCore builders and Quick business users.
• Shared agents work across chat, apps, flows, and deep research contexts.

Current personalized agents rely on text transcripts and captions, which fail to capture perceptual data like voice tone or facial expressions. The authors demonstrate that caption-based retrieval recovers only 0.11 recall compared to dedicated encoders for non-nameable signals. Their approach decomposes memory into a vision-language model for grounding and a dedicated encoder for perceptual storage.

• Text-only memory discards critical perceptual signals like voice and face recognition.
• Caption-based retrieval performs near chance on non-nameable user attributes.
• Proposed method uses VLM for context grounding and dedicated encoders for memory.
• New architecture enables persistent multimodal user profiles beyond simple text.

Terminal-Bench-LILT introduces a multilingual coding benchmark with 300 tasks across ten languages, addressing the English-centric bias in current AI evaluations. The tasks focus on region-specific challenges like internationalization, encoding, and cultural conventions, authored by native speakers. Tests on six leading models show a maximum pass rate of only 63.1%, highlighting significant performance drops in non-English contexts.

• Current coding agents fail significantly on non-English tasks, maxing out at 63.1% pass rate.
• Benchmark covers 10 languages including Arabic, Japanese, and Hindi with native-authored tasks.
• Focuses on real-world issues like text normalization and cultural conventions absent in English.
• Reveals that top-tier models are not yet ready for global, multilingual deployment.

Amazon Redshift now supports the Agent Toolkit for AWS, allowing AI coding assistants like Claude Code and Cursor to manage data warehouses via the AWS MCP server. This integration provides authenticated API execution and specific Redshift skills to help agents generate SQL, explore schemas, and optimize materialized views. The feature aims to reduce query errors and streamline data loading and migration tasks through curated reference materials.

• Enable AI agents to execute authenticated AWS API calls for Redshift management tasks.
• Leverage Redshift skills for accurate SQL syntax, schema discovery, and best practices.
• Supports popular AI tools including Claude Code, Kiro, and Cursor.
• Covers data loading patterns, materialized views, and extensions like Pivot.

Firecrawl released pdf-inspector, a native Rust library designed to classify PDFs and extract text with position awareness in under 200ms. It intelligently distinguishes between text-based and scanned documents, allowing systems to skip expensive OCR services for the majority of cases. The tool supports selective OCR and provides bindings for Python, Node.js, and WebAssembly.

• Classifies PDFs as TextBased, Scanned, ImageBased, or Mixed in 10-50ms via sampling.
• Converts text-based PDFs to clean Markdown without requiring OCR processing.
• Native Rust core with bindings for Python, Node.js, and browser WebAssembly.
• Optimize pipelines by routing scanned docs to OCR and skipping text-based ones.

AWS has expanded support for Lambda recursive loop detection to all commercial AWS Regions, enabling this safety guardrail globally. The feature is enabled by default and automatically halts runaway workloads caused by misconfigured event sources like S3, SQS, or SNS that trigger functions which send events back to the original source. When a loop is detected, processing stops and an AWS Health Dashboard notification is sent with troubleshooting steps.

• Recursive loop detection is now available in all commercial AWS Regions.
• The feature is enabled by default to prevent runaway workloads and unexpected billing.
• It blocks loops triggered by S3, SQS, and SNS event sources.
• Operators receive AWS Health Dashboard notifications with troubleshooting guidance.
• No configuration change is required to benefit from this global expansion.

AWS has expanded Automated Security Response with an AI Toolkit that generates custom remediation code using any AI assistant, complete with built-in safety guardrails. The update also enables automatic remediation for findings from Amazon Inspector, GuardDuty, and Macie, while centralizing configuration via account, OU, region, and tags. Additionally, new multi-channel adapters for Email, Slack, Jira, and ServiceNow allow severity-based filtering and deadline enforcement for Security Hub alerts.

• AI Toolkit accelerates custom remediation development from weeks to hours with safety guardrails.
• Auto-remediation now covers findings from Inspector, GuardDuty, and Macie services.
• Centralized scoping allows configuration by account, OU, region, or resource tags.
• Multi-channel alerts support Email, Slack, Jira, and ServiceNow with deadline enforcement.

Amazon EMR on EKS now supports admission control for job runs, allowing you to set concurrent execution limits on virtual clusters. The StartJobRun API accepts backpressure signals to manage queues for jobs in PENDING or SUBMITTED states. This feature provides fine-grained control to prevent shared EKS clusters from being overloaded in multi-tenant environments.

• Set strict concurrency limits per virtual cluster to cap simultaneous job runs.
• Use backpressure signals in StartJobRun API to manage job queuing.
• Protect shared EKS clusters from resource exhaustion in multi-tenant setups.
• Gain visibility into jobs stuck in PENDING or SUBMITTED states via logical queues.
• Applies to open-source frameworks like Spark and Flink running on EMR on EKS.

Amazon Aurora Serverless now offers up to 30% improved performance and enhanced scaling algorithms across five additional AWS Regions. The update applies to both Aurora PostgreSQL and Aurora MySQL, targeting workloads with unpredictable traffic like agentic AI applications. The system continues to scale down to zero when idle, ensuring cost efficiency for bursty or intermittent demand patterns.

• Performance gains apply to both Aurora PostgreSQL and MySQL serverless engines.
• Available in New Zealand, Thailand, Cape Town, Milan, and Central Mexico.
• Smarter scaling handles resource competition in busy web and API services.
• Ideal for agentic AI apps with traffic bursts and unpredictable idle periods.
• Cost model remains pay-per-use with scaling to zero during inactivity.

Amazon Redshift now reads and writes Apache Iceberg v3 tables, introducing default column values, row lineage, and deletion vectors. Default values simplify schema evolution by applying initial values when data is missing. Row lineage enables incremental pipelines and CDC workflows by tracking row identity and update sequences. Deletion vectors replace positional delete files with compact compressed bitmaps for improved efficiency.

• Default column values simplify schema evolution when adding columns to existing tables.
• Row lineage pseudo-columns enable efficient incremental pipelines and CDC workflows.
• Deletion vectors use compact compressed bitmaps, replacing v2 positional delete files.
• Redshift now fully supports reading and writing Iceberg v3 tables in data lakes.

Amazon EC2 has generally available the R9g and R9gd memory-optimized instances, driven by fifth-generation AWS Graviton5 custom CPUs. R9g targets memory-intensive workloads like databases, caches, and big data analytics, while R9gd adds local NVMe-based SSD storage for those requiring high-speed block-level access. These instances aim to deliver superior price-performance for Linux-based applications, including containerized microservices and various programming languages.

• Graviton5 CPUs now power R9g/R9gd, offering best-in-class price performance for memory-intensive tasks.
• R9gd instances include local NVMe SSDs, suitable for workloads needing fast block-level storage.
• Optimized for databases, in-memory caches, real-time analytics, and containerized Linux apps.
• Supports major languages including C/C++, Rust, Go, Java, Python, and .NET Core.

AWS has added support for in-place major version upgrades (MVU) for Amazon DocumentDB, allowing clusters running engine versions 3.6 or 4.0 to jump directly to version 8.0. This capability eliminates the requirement for sequential intermediate upgrades, preserving data and cluster configurations during the transition. The new version provides updated security patches, performance enhancements, and fresh developer features.

• Eliminates multi-step upgrade paths by allowing direct jumps from 3.6 or 4.0 to 8.0.
• In-place upgrades preserve existing data, configurations, and cluster settings without migration.
• Access to latest security patches and performance improvements in engine 8.0.
• Feature is available in all AWS regions where older versions are currently supported.
• Review MVU documentation for detailed upgrade guidance and version differences before proceeding.

Amazon Redshift now allows provisioned clusters and serverless workgroups to authenticate using AWS IAM Identity Center tokens. When configured with Enhanced VPC Routing (EVR), all traffic remains within the AWS network, traversing the VPC for strict governance. This setup enables single sign-on with corporate credentials while ensuring no public internet egress, satisfying data residency and regulatory isolation requirements.

• Enables SSO via IAM Identity Center for Redshift provisioned clusters and serverless workgroups.
• Enhanced VPC Routing ensures traffic stays within the VPC, eliminating public internet exposure.
• Facilitates compliance with strict data residency and network isolation mandates.
• Security is enforced through VPC security groups, NACLs, and endpoint policies.
• Traffic visibility is maintained via VPC Flow Logs for comprehensive auditing.

Amazon Kinesis Data Streams now supports streaming tables, a serverless feature that continuously writes data from Kinesis to Amazon S3 Tables in Apache Iceberg format. This capability removes the need for self-managed delivery pipelines, cutting data delivery costs by up to half. Inline compaction addresses the small file problem to maintain predictable query performance and reduce downstream query expenses by up to 30 percent.

• Eliminates operational overhead of self-managed Iceberg ingestion pipelines.
• Reduces data delivery costs by up to 50% via serverless architecture.
• Inline compaction mitigates small file issues and stabilizes query performance.
• Optimized for near real-time analytics and AI/ML feature store pipelines.